SOF Day 1 Review

What are some of the costs associated with a data breach? (Select more than one answer.)

• Fines

• Re-Training Employees

• Reputation Damage

• Nothing - Data Breaches don't cost anything

What are some signs a security operations organization is at ServiceNow's "Maturity Level 2"? (Multiple answers)

• Automated querying of internal and supplier environments

• Prioritization by impact

• KPIs, Reporting, and SLAs

• Noise Reduction

• Easily handle common attacks to improve response closure

Answer explanation

Automated querying of internal and supplier environments is part of level 5 Easily handle common attacks to improve response closure is part of level 4.

True or False: It is better to add roles directly to a user rather than adding roles to a group and then users to the group.

• True

• False

Answer explanation

Adding roles to the group then users to that group prevents a user from keeping a role they should not have.

What is the scope prefix for Security Incident?

• sn_sec_si

• sn_sec_cmn

• sn_vul

• sn_si

What is the scope prefix for Vulnerability Response?

• sn_sec_vul

• sn_vul

• sn_si

• sn_sec_cmn

Which are features from Security Support Common (but can be used for other purposes)?

There are multiple answers.

• Enrichment Data Mapping

• Email Parsing

• Escalations

• Workflow Triggers

• Filter Groups

True or False. Vulnerable Items can only be part of one Remediation Task (Vulnerability Group).

• True

• False

Answer explanation

Vulnerable Items and Remediation Tasks (Vulnerability Groups) are related in the sn_vul_m2m_vul_group_item table.

What is a Vulnerable Item?

• A Vulnerability and a unique Configuration Item (CI)

• A Vulnerability and a generic Configuration Item (CI)

• Several vulnerabilities on a unique Configuration Item (CI)

• Several vulnerabilities on a generic Configuration Item (CI)

What is a CWE?

• Controlled Weapons Experiment

• Common Weakness Enumeration

• Courtesy Wakes for Eggs

• Common Weakness Extravaganza

How is a CVE different from a CWE?

• CVEs are from the US Government and CWEs are from Canada

• CWEs are specific instantiations of CVEs

• CVEs are specific instantiations of CWEs

• They're the same thing